LOCAL NETWORK FORENSICS
PCAP Analysis Report
Generated 2026-08-12 08:45:31 UTC
Capturemulti-app-detection-example.pcap
Device IP192.168.1.114
Packets8,823
Traffic4.97 MB
Duration52.6 seconds
Flows433
PlatformiOS
Capture started2026-07-29 10:07:35 UTC
Capture ended2026-07-29 10:08:27 UTC
Result 1
Blockudoku - Block Puzzle Game
com.easybrain.blockudoku100%
IOS
VERY HIGH
Identified by: Apple lookup bundleId parameter
Apple lookup request exposed bundleId=com.easybrain.blockudoku
Observed network activity
2026-07-29 10:08:00 UTC
Supporting evidence
- Trusted URL identifier: bundleId=com.easybrain.blockudoku on itunes.apple.com/lookup
Result 2
DramaBox - Stream Drama Shorts
com.storymatrix.drama81%
IOS
HIGH
Identified by: Classification model + capture fingerprint
The trained classification model probability was combined with similarity to reference-capture fingerprints
Observed network activity
2026-07-29 10:07:37 UTC - 2026-07-29 10:07:52 UTC
Supporting evidence
- Matched destination aws-oversea-new.ap-southeast-1.log.aliyuncs.com via dns, tls_sni
- Matched destination hwztchapter.dramaboxdb.com via tls_sni
- Matched destination sc-sa.dramaboxdb.com via tls_sni
- Matched destination deviceenrollment.v.aaplimg.com via dns
- Matched destination alb-orfzyed48wsq1mpiwl.ap-southeast-1.alb.aliyuncsslbintl.com via dns
- Matched destination noatt.prod.adjoe.zone via dns, tls_sni
- Matched destination deviceenrollment.apple.com via tls_sni
- Matched destination ocsp.apple.com via tls_sni
- 7 supporting TLS/JA4 fingerprint(s)
- 252 ordered destination marker(s) matched
- Classification model probability: 98.9%
Observed network evidence
Contacted domains
- consent.adjust.com
- noatt.prod.adjoe.zone
- hwztakavideo.dramaboxdb.com
- cdn2.inner-active.mobi
- ads.inmobi.com
- bag-cdn-lb.itunes-apple.com.akadns.net
- ep2.facebook.com
- firebaselogging-pa.googleapis.com
- app-analytics-services.com
- www.inmobi.com
- api16-access-wf-sg.pangle.io
- mi.adsurge.com
- gateway.unityads.unity3d.com
- odf.app-ads-services.com
- api-apac.bidmachine.io
- adx.ads.vungle.com
- gcs-eu-00002.content-storage-upload.googleapis.com
- logs.ads.vungle.com
- hwztvideo.dramaboxdb.com
- s3-analytics-events.easybrain.com
- storevalidator.easybrain.com
- cfg.easybrain.com
- consent.easybrain.com
- ets.easybrain.com
- bib.easybrain.com
- egas.easybrain.com
- cdn.mobilefuse.com
- awards.easybrain.com
- up.easybrain.com
- cross-promo-provider.easybrain.com
- tournaments.easybrain.com
- rcs.easybrain.com
- api-liveops.easybrain.com
- teamrace.easybrain.com
- wv.inner-active.mobi
- googleads.g.doubleclick.net
- api16-access-ttp.tiktokpangle.us
- api.bidmachine.io
- blockudoku.zendesk.com
- sdkc.vervegroupinc.net
- mads.amazon-adsystem.com
- mdtb-cf-1.ads.aps.amazon-adsystem.com
- aax-fe.amazon-adsystem.com
- www.gstatic.com
- www.googletagservices.com
- csi.gstatic.com
- sdk-files.smaato.net
- rr1---sn-oxu8pnpvo-nq8s.googlevideo.com
- star.c10r.facebook.com
- star.fallback.c10r.facebook.com
Visible HTTP endpoints
GET itunes.apple.com/lookup- parameters: bundleId, country